@wirecat/cli-core 0.421.0 → 0.423.0

package/dist/cli/embedding-choice.js

@@ -6,10 +6,8 @@ import { isLocal, remoteModel } from "../embeddings/remote.js";
 import { readOnlyLockOf, readOnlyRefusal } from "../ports/app.js";
 import { typedCommand } from "../runs/scope.js";
 /** A local model id, or a remote model with its key from `models keys set`. */
-export const embeddingChoice = ({ model, provider, embeddingProvider, baseUrl, dims, concurrency }, app, settings, env, { needKey = true, keyring } = {}) => {
-    if (embeddingProvider !== undefined && provider !== undefined)
-        throw new CliError("validation_error", "give --embedding-provider or its legacy --provider spelling, not both");
-    provider = embeddingProvider ?? provider;
+export const embeddingChoice = ({ model, embeddingProvider, baseUrl, dims, concurrency }, app, settings, env, { needKey = true, keyring } = {}) => {
+    let provider = embeddingProvider;
     const flagsChooseProvider = (provider !== undefined && provider !== (settings.embeddingProvider ?? "local")) ||
         (baseUrl !== undefined && baseUrl.replace(/\/+$/, "") !== settings.embeddingBaseUrl?.replace(/\/+$/, ""));
     provider ??= flagsChooseProvider ? "openai" : (settings.embeddingProvider ?? "local");

package/dist/cli/first-run.d.ts

@@ -1,22 +1,6 @@
 import { type Installer } from "@wirecat/cli-base/update";
 import { type Question } from "./setup-answers.js";
 /** The languages cli-core stems and has a dictionary for; each is one stemmer of its alphabet. */
-export declare const LANGUAGES: readonly [{
-    readonly name: "russian";
-    readonly code: "ru";
-    readonly label: "Russian";
-    readonly script: "cyrillic";
-}, {
-    readonly name: "english";
-    readonly code: "en";
-    readonly label: "English";
-    readonly script: "latin";
-}, {
-    readonly name: "spanish";
-    readonly code: "es";
-    readonly label: "Spanish";
-    readonly script: "latin";
-}];
 export interface FirstRunIo {
     ask: (prompt: string) => Promise<string>;
     say: (text: string) => void;

package/dist/cli/first-run.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { accessSync, constants, realpathSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { installerOf, updateCommand } from "@wirecat/cli-base/update";
+import { LANGUAGES } from "../search/languages.js";
 import { DEFAULT_STEMMERS } from "../search/stem.js";
 import { openCache } from "../store/open.js";
 import { storePath } from "../store/path.js";
@@ -11,12 +12,6 @@ import { readSecret } from "../terminal/prompt.js";
 import { WIRECAT_TOOLS } from "./help/first-screen.js";
 import { buildStems } from "./messenger/store-maintenance-command.js";
 import { QUESTIONS, readSetupAnswers, unanswered, writeSetupAnswers, } from "./setup-answers.js";
-/** The languages cli-core stems and has a dictionary for; each is one stemmer of its alphabet. */
-export const LANGUAGES = [
-    { name: "russian", code: "ru", label: "Russian", script: "cyrillic" },
-    { name: "english", code: "en", label: "English", script: "latin" },
-    { name: "spanish", code: "es", label: "Spanish", script: "latin" },
-];
 /** Commands that run without first-run questions: they serve agents, help, or open the store themselves. */
 const SKIPPED = new Set(["help", "guide", "completion", "mcp", "serve", "server", "update", "store"]);
 /**

package/dist/cli/index.d.ts

@@ -26,6 +26,7 @@ export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { crashOf, type Recording, type RecordingOptions, recorded, startRecording, wasSettled, } from "../runs/recording.js";
 export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, type RunMetadata, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { currentRun, inRun, type RunScope, useAsProcessRun } from "../runs/scope.js";
+export { LANGUAGES } from "../search/languages.js";
 export { guardedApp, guardedPress, guardedStart, type Pressed } from "../sends/buttons.js";
 export { guardedClose, guardedCreatePoll, guardedVote } from "../sends/polls.js";
 export type { InboxReader } from "../services/inbox.js";
@@ -51,6 +52,7 @@ export type { CommandAvailability, DiscoveredCommand } from "./command-availabil
 export { commandContract, type JsonSchema, SCHEMA_DIALECT } from "./command-contract.js";
 export { CONTRACT } from "./commands-command.js";
 export { refuseUnknownKey } from "./config-command.js";
+export type { ConfigIssue, ConfigIssueKind } from "./config-issues.js";
 export { loadSnakeCaseConfig } from "./config-keys.js";
 export { type AgentRun, type BaseContext, type BaseEnvironment, baseContext, environmentOf, outputFor, provide, secretInputOf, } from "./context.js";
 export { addContractInfo, type ContractEvidenceOptions, contractEvidence } from "./contract-evidence.js";
@@ -62,7 +64,7 @@ export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNoth
 export { type CliEntry, type EntryContext, type EntryIo, startCli } from "./entry.js";
 export { type AnswerOutput, answerSchema, type Body, type ItemBody, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, type ListBody, type ListInput, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
-export { askSetupQuestions, asksAtStart, type FirstRun, type FirstRunIo, LANGUAGES, setupAtStart, systemLanguage, } from "./first-run.js";
+export { askSetupQuestions, asksAtStart, type FirstRun, type FirstRunIo, setupAtStart, systemLanguage, } from "./first-run.js";
 export { checkGuide, checkStep, type GuideOptions, type GuideReference, type GuideStep, loadScenarios, MEMO_SCENARIOS, type Scenario, shellProblems, } from "./guide.js";
 export { type CommandHelp, commandHelp, commandHelpMarkdown, commandHelpText, exampleReport, type NextChoice, nextUsually, } from "./help/command-help.js";
 export { commandsText } from "./help/commands-text.js";

package/dist/cli/index.js

@@ -22,6 +22,7 @@ export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { crashOf, recorded, startRecording, wasSettled, } from "../runs/recording.js";
 export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { currentRun, inRun, useAsProcessRun } from "../runs/scope.js";
+export { LANGUAGES } from "../search/languages.js";
 export { guardedApp, guardedPress, guardedStart } from "../sends/buttons.js";
 export { guardedClose, guardedCreatePoll, guardedVote } from "../sends/polls.js";
 export { INBOX_CHATS, newIn, REVIEW_CHATS, reviewIn, unreadIn } from "../services/inbox.js";
@@ -55,7 +56,7 @@ export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNoth
 export { startCli } from "./entry.js";
 export { answerSchema, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";
-export { askSetupQuestions, asksAtStart, LANGUAGES, setupAtStart, systemLanguage, } from "./first-run.js";
+export { askSetupQuestions, asksAtStart, setupAtStart, systemLanguage, } from "./first-run.js";
 export { checkGuide, checkStep, loadScenarios, MEMO_SCENARIOS, shellProblems, } from "./guide.js";
 export { commandHelp, commandHelpMarkdown, commandHelpText, exampleReport, nextUsually, } from "./help/command-help.js";
 export { commandsText } from "./help/commands-text.js";

package/dist/cli/messenger/context.js

@@ -355,7 +355,7 @@ export const messengerContext = (command, messenger, resolving = {}) => {
     const { profile } = base.settings;
     refuseDenied(command, base.settings);
     refuseLacking(messenger, pathOf(command));
-    refuseUnknownPermissionKeys(command, base.settings.permissions, `${app.command} ${asFirstWord(profile)}config unset`, messenger.permissionKey);
+    refuseUnknownPermissionKeys(command, base.settings, app.command, messenger.permissionKey);
     // Read when warning, not now: serve swaps the renderer's methods for log records after this.
     const warn = (text, warning) => base.renderer.warn(text, warning);
     const accountFor = () => {

package/dist/cli/messenger/conversations-command.js

@@ -37,8 +37,8 @@ const conversationBuildCommand = (messenger) => boundOptions(reachesOtherService
     .option("--chat <chat>", messenger.chatArgument)
     .option("--analyze", "link batches using the configured analysis provider; requires --chat and remembers consent for this chat/provider")
     .addOption(new Option("--analysis-provider <provider>", "analysis: agent, openai or anthropic"))
-    .option("--model <model>", "analysis model; overrides analysis_model")
-    .option("--base-url <url>", "analysis API endpoint; overrides analysis_base_url")
+    .option("--model <model>", "analysis model; overrides models.analysis.model")
+    .option("--base-url <url>", "analysis API endpoint; overrides models.analysis.base_url")
     .option("--size <n>", "analysis answer messages per batch, 10–200; default 50", positiveCount("--size"))
     .option("--max-tokens <n>", "analysis input/output reservation cap per run; default 100000", positiveCount("--max-tokens")), { chunks: false }).action(async function () {
     const options = this.optsWithGlobals();
@@ -93,7 +93,6 @@ const conversationBuildCommand = (messenger) => boundOptions(reachesOtherService
         return;
     }
     if (options.analysisProvider !== undefined ||
-        options.provider !== undefined ||
         options.model !== undefined ||
         options.baseUrl !== undefined ||
         options.size !== undefined ||
@@ -133,10 +132,7 @@ const embeddingClearCommand = (messenger) => withModelOptions(destroysNothing(an
     const chat = chatOf(options);
     const context = messengerContext(this, messenger);
     refuseLocalWrite(context, messenger.app.command, EMBED_KEY);
-    const given = options.model !== undefined ||
-        options.embeddingProvider !== undefined ||
-        options.provider !== undefined ||
-        options.baseUrl !== undefined;
+    const given = options.model !== undefined || options.embeddingProvider !== undefined || options.baseUrl !== undefined;
     const model = given ? choiceOf(options, messenger, context, { needKey: false }) : undefined;
     const cleared = await context.withServices((services) => services.embeddings.clear(chat, model));
     renderAnswer(this, context, itemOf(cleared), () => `${cleared.cleared} vectors dropped\n`);
@@ -379,14 +375,14 @@ export const conversationsCommand = (messenger) => {
         .option("--chat <chat>", "revoke only this chat's consents; defaults to every chat")
         .addOption(new Option("--consent-provider <identity>", "exact provider identity from consents list; defaults to every provider"))
         .action(async function () {
-        const { chat, provider, consentProvider } = this.opts();
+        const { chat, consentProvider } = this.opts();
         const context = messengerContext(this, messenger);
         refuseLocalWrite(context, messenger.app.command, LINKS_KEY);
         await context.withStore(async (store, account) => {
             const chatId = chat === undefined
                 ? undefined
                 : (await servicesFor(storedDeps(messenger, store, account, context.guard)).conversations.batchStatus(chat, BATCH_SIZE.default)).chat;
-            await analysisConsents(store, account).revoke(chatId, consentProvider ?? provider);
+            await analysisConsents(store, account).revoke(chatId, consentProvider);
         });
         renderAnswer(this, context, itemOf({ revoked: true }));
     });

package/dist/cli/messenger/doctor-command.js

@@ -1,5 +1,6 @@
+import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { writeSecurely } from "@wirecat/cli-base";
+import { configFilePath, resolvePaths, writeSecurely } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { engineStates } from "../../attachments/extract.js";
@@ -11,6 +12,8 @@ import { storePath } from "../../store/path.js";
 import { baseContext, environmentOf, outputFor } from "../context.js";
 import { destroysNothing, LOCAL_WRITE, NO_EFFECTS, REMOTE_READ } from "../effects.js";
 import { itemOf, renderAnswer, snakeKeys } from "../envelope.js";
+import { unknownPermissionIssues } from "../permission-keys.js";
+import { NONE_NAMED } from "../settings.js";
 import { lineOf, nextStep } from "../steps.js";
 import { recalledAccount } from "./accounts.js";
 import { messengerContext } from "./context.js";
@@ -126,14 +129,45 @@ const diagnose = async (command, messenger) => {
         platform: process.platform,
         arch: process.arch,
     };
+    // Every problem in the file is reported, not refused: doctor is what a person runs when nothing else will.
     let context;
     try {
-        context = baseContext(command, messenger.resolveSettings);
+        context = baseContext(command, (flags, options) => messenger.resolveSettings(flags, { ...options, needsProfile: false, readOnly: true, withIssues: true }));
     }
     catch (error) {
-        return { report: { cli, config: { error: messageOf(error) } } };
+        // Not the file: a profile lock, a flag or an environment variable the settings refuse.
+        const path = configFilePath(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).config);
+        return {
+            report: {
+                cli,
+                config: { path, found: existsSync(path), issues: [] },
+                settings: { error: messageOf(error) },
+                store: snakeKeys(await storeSummary(env)),
+                runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+            },
+        };
     }
     const { settings, renderer } = context;
+    const config = {
+        path: settings.configPath,
+        found: settings.configFound,
+        issues: [
+            ...(settings.configIssues ?? []),
+            ...unknownPermissionIssues(command, settings, app.command, messenger.permissionKey),
+        ],
+    };
+    if (settings.sources.profile === NONE_NAMED)
+        return {
+            renderer,
+            report: {
+                cli,
+                profile: null,
+                config,
+                store: snakeKeys(await storeSummary(env)),
+                readers: engineStates(),
+                runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+            },
+        };
     const { profile } = settings;
     const account = recalledAccount(app, provider, profile, env);
     const store = storePath(env);
@@ -151,7 +185,7 @@ const diagnose = async (command, messenger) => {
         report: {
             cli,
             profile,
-            config: { path: settings.configPath, found: settings.configFound },
+            config,
             account: { remembered: account?.account ?? null },
             // A session file on disk says nothing about whether the messenger still accepts it.
             login: { state: "not checked" },

package/dist/cli/messenger/inbox.js

@@ -2,7 +2,6 @@ import { CliError } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { renderMessages } from "../../render/messages.js";
-import { kindsOf } from "../../services/inbox.js";
 import { modelWith } from "../../speech/hearing.js";
 import { REMOTE_READ } from "../effects.js";
 import { renderAnswer } from "../envelope.js";
@@ -44,15 +43,12 @@ export const inboxCommand = (messenger) => annotate(new Command("inbox"), {
     .option(...MODEL_OPTION)
     .addHelpText("after", "To mark a chat read, use `chats mark-read <chat>`. The other side sees it.")
     .action(async function (query) {
-    const { new: fresh, all, kind, transcribe, model, } = this.opts();
+    const { new: fresh, all, transcribe, model, } = this.opts();
     const hearWith = modelWith(transcribe, model);
     const context = messengerContext(this, messenger);
     const { app } = messenger;
     const { settings, renderer, format, env } = context;
-    const { since, meta, kinds: queriedKinds } = catchUpQuery(query, INBOX_QUERY, "inbox");
-    if (kind !== undefined && queriedKinds !== undefined)
-        throw new CliError("validation_error", "give kind: or its legacy --kind spelling, not both");
-    const kinds = queriedKinds ?? (kind === undefined ? undefined : kindsOf(kind));
+    const { since, meta, kinds } = catchUpQuery(query, INBOX_QUERY, "inbox");
     if (fresh && since !== undefined)
         throw new CliError("validation_error", "--new keeps its own point — not with a date in the query");
     const saved = fresh && since === undefined

package/dist/cli/messenger/private-people-command.js

@@ -65,8 +65,7 @@ export const privatePeopleCommands = (messenger) => {
         command.action(async function (person, id) {
             const context = messengerContext(this, messenger);
             refuseLocalWrite(context, messenger.app.command, `contacts.notes.${name}`);
-            const { textFile, file: legacyFile, revision, } = this.opts();
-            const file = textFile ?? legacyFile;
+            const { textFile: file, revision } = this.opts();
             const text = file === undefined || file === "-" ? await readAll(context.stdin) : await readFile(file, "utf8");
             const version = Number(revision);
             if (name === "edit" && (!Number.isSafeInteger(version) || version < 1))

package/dist/cli/messenger/review.js

@@ -3,7 +3,7 @@ import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { parseDuration } from "../../domain/duration.js";
 import { renderMessages } from "../../render/messages.js";
-import { kindsOf, REVIEW_DAYS, reviewStart, UNANSWERED_HOURS } from "../../services/inbox.js";
+import { REVIEW_DAYS, reviewStart, UNANSWERED_HOURS } from "../../services/inbox.js";
 import { modelWith } from "../../speech/hearing.js";
 import { REMOTE_READ } from "../effects.js";
 import { renderAnswer } from "../envelope.js";
@@ -45,9 +45,7 @@ export const reviewCommand = (messenger) => annotate(new Command("review"), {
     const hearWith = modelWith(options.transcribe, options.model);
     const context = messengerContext(this, messenger);
     const { settings, renderer, format, env } = context;
-    const { since: from, chat, meta, kinds: queriedKinds } = catchUpQuery(query, REVIEW_QUERY, "review");
-    if (options.kind !== undefined && queriedKinds !== undefined)
-        throw new CliError("validation_error", "give kind: or its legacy --kind spelling, not both");
+    const { since: from, chat, meta, kinds } = catchUpQuery(query, REVIEW_QUERY, "review");
     if (options.new && (from !== undefined || options.unanswered !== undefined)) {
         // An open question stays open: moving past it would drop it from the next review.
         throw new CliError("validation_error", "--new keeps its own point — not with a date or --unanswered");
@@ -62,7 +60,6 @@ export const reviewCommand = (messenger) => annotate(new Command("review"), {
         : undefined;
     const since = from ?? saved?.first ?? reviewStart();
     const hours = options.unanswered === undefined ? undefined : unansweredHours(options.unanswered);
-    const kinds = queriedKinds ?? (options.kind === undefined ? undefined : kindsOf(options.kind));
     let hearing;
     const transcribe = options.transcribe === true;
     const { found, reader } = await context.withServices(async (services, connect) => {

package/dist/cli/permission-keys.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 import { type PermissionKey } from "../sends/permissions.js";
+import { type ConfigIssue } from "./config-issues.js";
+import type { Settings } from "./settings.js";
 export type PermissionKeyOf = (command: Command) => PermissionKey | null | undefined;
 /**
  * The keys `permissions` may name: every command of the program, every write key, and each of their
@@ -9,5 +11,10 @@ export declare const knownPermissionKeys: (command: Command, keyOf?: PermissionK
 /** The known keys one level under the unknown key's parent, to name in the refusal. */
 export declare const knownBeside: (key: PermissionKey, known: ReadonlySet<PermissionKey>) => PermissionKey[];
 export declare const unknownPermissionKeys: (levels: Readonly<Record<PermissionKey, unknown>>, known: ReadonlySet<PermissionKey>) => PermissionKey[];
-/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
-export declare const refuseUnknownPermissionKeys: (command: Command, levels: Readonly<Record<PermissionKey, unknown>>, unset: string, keyOf?: PermissionKeyOf) => void;
+/** Every unknown permission key saved in the file, in every section and profile, with the unset that removes it. */
+export declare const unknownPermissionIssues: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => ConfigIssue[];
+/**
+ * A saved key no command checks would do nothing, so the command refuses to run and names the unset that removes
+ * it. A `--permission` key is checked too: it is no file's, so the flag is the fix.
+ */
+export declare const refuseUnknownPermissionKeys: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => void;

package/dist/cli/permission-keys.js

@@ -1,5 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
 import { CEILING_KEY, keyForCommand, WRITE_KEYS } from "../sends/permissions.js";
+import { issueMessage, permissionIssues, publicIssue } from "./config-issues.js";
 const pathOf = (command) => {
     const words = [];
     for (let at = command; at?.parent; at = at.parent)
@@ -42,10 +43,24 @@ export const knownBeside = (key, known) => {
         .sort();
 };
 export const unknownPermissionKeys = (levels, known) => Object.keys(levels).filter((key) => key !== CEILING_KEY && !known.has(key));
-/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
-export const refuseUnknownPermissionKeys = (command, levels, unset, keyOf) => {
-    const [key] = unknownPermissionKeys(levels, knownPermissionKeys(command, keyOf));
-    if (key === undefined)
-        return;
-    throw new CliError("configuration_error", `permissions.${key} names no command — remove it with \`${unset} permissions.${key}\``, { permission: key });
+/** Every unknown permission key saved in the file, in every section and profile, with the unset that removes it. */
+export const unknownPermissionIssues = (command, settings, tool, keyOf) => {
+    const saved = settings.savedPermissions ??
+        Object.keys(settings.permissions)
+            .filter((key) => key !== CEILING_KEY && settings.permissionSources[key] !== "flag")
+            .map((key) => ({ key, at: ["profiles", settings.profile, "permissions", key] }));
+    return permissionIssues(saved, knownPermissionKeys(command, keyOf), { file: settings.configPath, tool }).map(publicIssue);
+};
+/**
+ * A saved key no command checks would do nothing, so the command refuses to run and names the unset that removes
+ * it. A `--permission` key is checked too: it is no file's, so the flag is the fix.
+ */
+export const refuseUnknownPermissionKeys = (command, settings, tool, keyOf) => {
+    const issues = unknownPermissionIssues(command, settings, tool, keyOf);
+    if (issues.length > 0)
+        throw new CliError("configuration_error", issueMessage(issues), { permission: issues[0]?.key });
+    const flagged = Object.keys(settings.permissions).filter((key) => settings.permissionSources[key] === "flag");
+    const [key] = unknownPermissionKeys(Object.fromEntries(flagged.map((one) => [one, true])), knownPermissionKeys(command, keyOf));
+    if (key !== undefined)
+        throw new CliError("validation_error", `--permission ${key} names no command`, { permission: key });
 };

package/dist/cli/preview.d.ts

@@ -1,8 +1,9 @@
 import type { Command } from "commander";
-import { type Level, type PermissionKey } from "../sends/permissions.js";
+import { type PermissionKey } from "../sends/permissions.js";
+import type { Settings } from "./settings.js";
 export declare class PreviewComplete extends Error {
 }
-export declare const preview: (command: Command, permissions: Readonly<Record<string, Level>>, unset: string, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined) => {
+export declare const preview: (command: Command, settings: Pick<Settings, "permissions" | "permissionSources" | "configPath" | "savedPermissions" | "profile">, tool: string, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined) => {
     preview: boolean;
     path: string[];
     permission: {

package/dist/cli/preview.js

@@ -1,14 +1,15 @@
 import { CliError } from "@wirecat/cli-base";
 import { metaOf } from "@wirecat/cli-base/commands";
 import { writes as writesAnything } from "@wirecat/cli-base/standards";
-import { keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS, } from "../sends/permissions.js";
+import { keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS } from "../sends/permissions.js";
 import { commandPathOf } from "./command-contract.js";
 import { refuseUnknownPermissionKeys } from "./permission-keys.js";
 export class PreviewComplete extends Error {
 }
-export const preview = (command, permissions, unset, keyOf) => {
+export const preview = (command, settings, tool, keyOf) => {
     const path = commandPathOf(command);
-    refuseUnknownPermissionKeys(command, permissions, unset, keyOf && ((one) => keyOf(commandPathOf(one))));
+    const { permissions } = settings;
+    refuseUnknownPermissionKeys(command, settings, tool, keyOf && ((one) => keyOf(commandPathOf(one))));
     const key = keyForCommand(path);
     const level = key ? levelFor(permissions, key).level : "allow";
     for (const source of readKeysForCommand(path)) {

package/dist/cli/profile.d.ts

@@ -28,3 +28,5 @@ export declare const valuedOptions: (program: Command) => Set<string>;
 export declare const refuseCommandName: (profile: string, words: Set<string>, command: string) => void;
 /** The root of the command tree, from anywhere inside it. */
 export declare const rootOf: (command: Command) => Command;
+/** A command this CLI really has, for an example: the first that takes a profile, down to its first leaf. */
+export declare const sampleCommand: (commands: readonly Command[]) => string | undefined;

package/dist/cli/profile.js

@@ -59,3 +59,13 @@ export const rootOf = (command) => {
         root = root.parent;
     return root;
 };
+/** A command this CLI really has, for an example: the first that takes a profile, down to its first leaf. */
+export const sampleCommand = (commands) => {
+    const words = [];
+    let command = commands.find((one) => !PROFILE_FREE.has(one.name()));
+    while (command) {
+        words.push(command.name());
+        command = command.commands.find((one) => one.name() !== "help");
+    }
+    return words.length ? words.join(" ") : undefined;
+};

package/dist/cli/program.d.ts

@@ -10,7 +10,7 @@ export interface ProgramDefinition {
     /** The CLI's own settings, for keeping a failure that happened before its command could; plain ones without. */
     configuration?: {
         permissionKey?: (path: readonly string[]) => string | null | undefined;
-        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "permissions">>;
+        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "permissions" | "permissionSources" | "configPath" | "savedPermissions">>;
     };
     configure?: (program: Command) => void;
     /** The tool's pitch and "what you can do" lines on `--help` and a bare run. */

package/dist/cli/program.js

@@ -26,7 +26,7 @@ import { showInputFields } from "./input-fields.js";
 import { MAX_BUFFERED_INPUT, provideInputPolicy } from "./input-policy.js";
 import { checkJson, liftJson } from "./json-fields.js";
 import { PreviewComplete, preview } from "./preview.js";
-import { asFirstWord, commandWords, liftProfile, PROFILE_FREE, valuedOptions } from "./profile.js";
+import { commandWords, liftProfile, PROFILE_FREE, sampleCommand, valuedOptions } from "./profile.js";
 import { absolutePaths, relayTarget } from "./relay-route.js";
 import { settingsFor } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
@@ -37,11 +37,15 @@ import { commandAt, lineOf, withLines } from "./steps.js";
  */
 export const createProgram = ({ app, commands, configure, firstScreen }, { out, err } = {}) => {
     const program = new Command();
+    const mounted = commands();
+    const messenger = app.messenger !== false;
+    const found = messenger ? "found messages" : "found items";
+    const content = messenger ? "message content" : "content";
     program
         .name(app.command)
         .usage("[profile] [options] <command>")
         .description(`${app.description}\n\n` +
-        `The first word is the profile whenever it is not a command — \`${app.command} personal chats list\`.\n` +
+        `The first word is the profile whenever it is not a command — \`${app.command} personal ${messenger ? "chats list" : (sampleCommand(mounted) ?? "<command>")}\`.\n` +
         `\`${app.envPrefix}_PROFILE\` says the same thing for a whole shell session.\n` +
         "No profile is assumed: without one, a command that uses an account stops and lists the profiles here.")
         .version(app.version, "-V, --version")
@@ -49,21 +53,21 @@ export const createProgram = ({ app, commands, configure, firstScreen }, { out,
         .option("--json", "machine-readable output: one JSON value on stdout; --json=id,text keeps only those fields")
         .option("--jsonl", "machine-readable output: one JSON object per line, for streaming and jq")
         .option("--quiet", "diagnostics off; a failure is still said")
-        .option("--trace", "the connection's own log lines on stderr — never message content")
+        .option("--trace", `the connection's own log lines on stderr — never ${content}`)
         .option("--debug", "on a failure, its whole record — cause and stack — in place of the short line")
         .option("--timeout <duration>", "give up on the whole command after this — 30s, 2m, 500ms")
         .option("--offline", "answer from what was recorded and never connect; fails if nothing was")
         .option("--no-input", "never prompt or open interactive login; piped input remains available")
         .option("--max-input-bytes <bytes>", "maximum buffered input bytes (default: 16777216)")
         .option("--max-output-bytes <bytes>", "maximum machine output bytes (default: 4194304; 0 disables)")
-        .option("--brief", "found messages as reference, title, time, sender and excerpt only")
-        .option("--full", "found messages with their whole text and every provider field")
+        .option("--brief", `${found} as reference, title, time, ${messenger ? "sender" : "author"} and excerpt only`)
+        .option("--full", `${found} with their whole text and every provider field`)
         .option("--dry-run", "preview parsed arguments and permissions before running the action")
         .option("--yes", "go ahead without the question an ask level puts before a write")
-        .option("--record", "keep this run — ids and timings, never message content")
+        .option("--record", `keep this run — ids and timings, never ${content}`)
         .option("--no-record", "do not keep it, whatever the configuration says")
         .showHelpAfterError();
-    for (const command of commands())
+    for (const command of mounted)
         program.addCommand(command);
     configure?.(program);
     assertSharedContracts(program);
@@ -375,9 +379,13 @@ const runOnce = async (argv, definition, options) => {
                 // No permission governs housekeeping like `skill install`, so no profile's settings change its preview.
                 needsProfile: keyForCommand(path) !== null,
             });
-            const permissions = "permissions" in resolved ? resolved.permissions : {};
-            const unset = `${command} ${asFirstWord(resolved.profile)}config unset${path[0] === "bot" ? " --bot" : ""}`;
-            const previewed = preview(action, permissions, unset, definition.configuration?.permissionKey);
+            const previewed = preview(action, {
+                permissions: resolved.permissions ?? {},
+                permissionSources: resolved.permissionSources ?? {},
+                configPath: resolved.configPath ?? "",
+                profile: resolved.profile,
+                ...(resolved.savedPermissions ? { savedPermissions: resolved.savedPermissions } : {}),
+            }, command, definition.configuration?.permissionKey);
             renderAnswer(action, outputFor(action), itemOf(snakeKeys(previewed)));
             throw new PreviewComplete();
         }